![Welcome to Orange Frog Productions Scams, Shams & Flim-Flams Section [Banner]](images/ssff/ofp_banner_ssff.jpg)
Page last updated 11/24/2007
All external links last last verified 11/24/2007
Please be sure to read my Work-at-Home Scams Home Page
NOTE: All external links on this page open a new window.
Things I Did, Below
I, personally, receive email in HTML format. The following was received (and looked) like I received it. At the time, I was more interested in the message than the headers and do not have the original. This is a copy I forwarded to myself as I sent it to my father.
- I removed my email addresses. These came to various accounts and some no longer exist. There are places on this site you can get hold of me if you wish or need to. They are protected from spambots using JavaScript, but all you have to do is click on them.
- All scammer and related email addresses, and any actual website links have been changed, at least putting spaces into them. They appear as underlined blue links, though they aren't.
- Any notes I added in the actual letter are in square brackets ("[" "]"), are bold, red in color, and highlighted. If what I found "behind the links" (email or website) are different than what was displayed, I will include them in this type of note.
- All spelling, spacing, line-wrapping, and punctuation errors are the ones that appeared in the original received email. (I may or may not analyze some or all of these.)
Scam Example
Received 11/24/2007
This was spam email, as While I have a resume at CareerBuilder at this time, it was sent to an email address which I do NOT use for job search. (I just double-checked.)
NOTE: To allow search engines to find them, I've left the links in this email. Be careful if you check them out for yourself.
From: Shawn Patel
[link behind the name:
To:
Sent: Saturday, November 24, 2007 7:52 PM
Subject: Update: Employment Offer
Greetings,
My name is Boris Medvedev, I am the manager of a HR department of
Avesta Soft LABS, Inc. After review of your resume at CareerBuilder
website I'd like to offer a perfect vacancy for you. The vacancy
of a Financial Manager.
Let me give you some facts about our company first:
Avesta Soft LABS, Inc.(ASL) was registered back in 1998. The primary
focus of ASL is design, development, and support of operational and
financial software applications for the oil and gas industry. We are
interested in working on the markets of all countries without
exceptions and see promotion of its services through the network of
representatives. ASL also provides consulting services including
business process consulting, project management, as well as systems
analysis and integration.
Recently we have been receiving a great number of applications for
our services from customers in the USA and Canada. As we are strongly
interested to grant the best services and in the shortest dates to
overcome all the difficulties that are likely to appear, we decided
to establish a vacancy of the financial manager to deal with the
transactions of relatively small amounts of 1000-6000 USD.
So today, we are glad to offer you to:
:: become a part of our company
:: join a team of highly qualified specialists
:: get a prestigious part time job
The main advantages of working as a Financial Manager are:
:: You don't need any experience or specific knowledge
:: You don't need to make any advance payments
:: This job won't take much of your time
Your range of duties will include:
:: Receiving payments for the ordered software applications and
consulting services from the Avesta Soft LABS, Inc. clients to
your bank account
:: Withdrawing the funds and transferring them further to our
managers in one of the our branches
The transfer should be done by the means of WU or MG services to
fasten the process of the delivery of the funds. For your
services we offer base salary of 4000 USD per month and also
you'll receive compensation of 50 USD for each successful
transaction.
If you are interested in this job and would like to get more
information, you can just write an email to us, and our managers
will give a prompt and competent reply.
We are looking forward to working with you!
Your email was given by 3rd party website careerbuilder.com on our
request, as you or someone else subscribed to a job opportunities
newsletter.
Please reply ONLU to our e-mail:
Yours faithfully,
Boris Medvedev.
[NOTE: I left names, email addresses, and phone numbers in here for the search engines to find. DO NOT TRY TO CONTACT THEM! I'm SURE you will be ripped off! -LE]
Email Headers
Received 11/24/2007
Return-path:
<
Received: from mta3.manage.insightcom.com ([172.31.249.156])
by msb2.manage.insightcom.com
(Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006))
with ESMTP id
<
Received: from mxsf05.insightbb.com ([172.31.249.124])
by mta3.manage.insightcom.com
(Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006))
with ESMTP id
<
24 Nov 2007 19:35:44 -0500 (EST)
Received: from pool-72-78-130-15.phlapa.east.verizon.net
(HELO mxip07.insightbb.com) ([72.78.130.15]) by mxsf05.insightbb.com with
ESMTP; Sat, 24 Nov 2007 19:35:43 -0500
Received: from unknown (HELO icici-90.workgroup) ([210.18.186.242])
by mxip07.insightbb.com with ESMTP; Sat, 24 Nov 2007 19:35:41 -0500
Received: from [210.18.186.242] by mail.bluecranesolutions.com; Sun,
25 Nov 2007 06:22:34 +0530
Date: Sun, 25 Nov 2007 06:22:34 +0530
From: Shawn Patel
<
Subject: Update: Employment Offer
To:
Message-id:
<
MIME-version: 1.0
X-MIMEOLE: Produced By Microsoft MimeOLE V5.50.4522.1200
X-Mailer: Microsoft Office Outlook, Build 11.0.5510
Content-type: text/plain; charset=windows-1250
Content-transfer-encoding: 7bit
Thread-index: Aca6Q04GHYDAMA7H0CIX5QLLKM8L5D==
X-IronPort-AV: E=Sophos;i="4.21,462,1188792000";
d="scan'208";a="125964131"
Original-recipient: rfc822;
[NOTE: I left names, email addresses, and phone numbers in here for the search engines to find. DO NOT TRY TO CONTACT THEM! I'm SURE you will be ripped off! -LE]
Ok... Time to check the WhoIs of Avesta Soft Labs, Inc. A
quick Google search for the company name produces the site,
WhoIs Search Results for AdvantageGlobalGroup.org
Registration Service Provided By: BBA LTD
Contact: +1.2062035016
Domain Name: AVESTALABS.COM
Registrant:
n/a
Steve Chen Le (fenzart@fastmail.fm)
5th av., 197
Miramar
Havana
La Habana,1000
CU
Tel. +564.657883544
Creation Date: 21-Aug-2007
Expiration Date: 21-Aug-2008
Domain servers in listed order:
ns2.xxxdns.biz
ns1.xxxdns.biz
Administrative Contact:
n/a
Steve Chen Le (fenzart@fastmail.fm)
5th av., 197
Miramar
Havana
La Habana,1000
CU
Tel. +564.657883544
Technical Contact:
n/a
Steve Chen Le (fenzart@fastmail.fm)
5th av., 197
Miramar
Havana
La Habana,1000
CU
Tel. +564.657883544
Billing Contact:
n/a
Steve Chen Le (fenzart@fastmail.fm)
5th av., 197
Miramar
Havana
La Habana,1000
CU
Tel. 564.657883544
Status:ACTIVE
The data in this whois database is provided to you for
information
purposes only, that is, to assist you in obtaining
information about or
related to a domain name registration record. We make
this information
available "as is", and do not guarantee its accuracy. By
submitting a
whois query, you agree that you will use this data only
for lawful
purposes and that, under no circumstances will you use
this data to:
(1) enable high volume, automated, electronic processes
that stress or
load this whois database system providing you this
information; or
(2) allow, enable, or otherwise support the transmission
of mass
unsolicited, commercial advertising or solicitations via
fascimile,
electronic mail, or by telephone. The compilation,
repackaging,
dissemination or other use of this data is expressly
prohibited without
prior written consent from us. The registrar of record
is
PublicDomainRegistry. We reserve the right to modify
these terms at any time. By submitting this query, you
agree to abide
by these terms.
Red Flags, for Me
Ok... The email looks legit... The site looks legit... What raises the red flags for me?
- From the email itself:
- The description of the process is the same as KNOWN work-at-home job scams: Deposit checks into your or a new account you set up, withdraw cash from the account, wire the cash overseas. The problem occurs when the banks find the checks are bad/forged, pull the amount of the check out of the account, and demand that YOU cover the rest of the amount. If you don't, you may be prosecuted for passing bad checks.
- I have received NUMEROUS job offers, in the last couple of weeks for the same type of job, many purporting to be responding to my resume on CareerBuilder. While I am looking for a job, and have a resume there, the email address I use there is NOT the one to which this email was sent.
- The position they are offering me - Financial Manager - has NOTHING to do with the qualifications on my resume. So how is that "a perfect vacancy for" me?
- Spacing, grammar, and spelling errors are rare from a legitimate site offering a job. Numerous people have read those ads, from HR to Legal to the person who wrote it. SOMEONE would catch the errors.
- The email address FROM which this email was sent was NOT the same as the company offering the job. While I realize that consultant and contracting companies could be sending these emails out, there is absolutely NO indication that this is from anyone but the company, itself.
- The email TO WHICH I am to reply,
avestasoftlabs@gmail.com , is a FREE EMAIL ACCOUNT (gmail.com). If this company is legit and worth working for, why isn't the email address avestasoftlabs?
- From the email headers:
- The email address FROM which it was sent was
sdx @ bluecranesolutions.com . Again, why wasn't it sent from an avestasoftlabs account, and why can't I simply reply to the email to get information? - According to GeoBytes Spam Locator (just cut-and-paste email headers), this email was sent from 210.18.186.242, which is in Delhi, India. Why doesn't this match the email address of the sender (Shawn Patel)? ... the supposed NAME of the person sending it (Boris Medvedev doesn't sound Eastern Indian to me!)
- The email address FROM which it was sent was
- From the WhoIs of the (apparent) site:
- .FM (email address of registrant/admin) is the domain name for Micronesia.
- The address given for the registrant/admin is in CUBA!
- The contact phone number given (+1.2062035016) is from Washington (state), for Seattle, the islands of Mercer, Bainbridge and Vashon, and portions of the Seattle metro area from Des Moines to Woodway [Source: http://en.wikipedia.org/wiki/Area_code_206]
- 564 is ALSO an Area Code for Washington (state) [Source: http://www.bennetyee.org/ucsd-pages/area.html#564], and I can't find a way to read that phone number. (For example... Is it a country code? With nine (9) digits following it?) Why would the phone number for a Cuban registrant be out of Washington (state)? or ANY other country?
- Why am I receiving an email for a job in the US, from a Russian, sent by an American, about working for a website registered and administered out of Cuba? And why would all of those people use phone numbers (registrant/admin) based out of Washington State? GEEZE!
End Notes
The site looks real. And there are a lot of pages for a scammer to set up. Why would they go to the trouble?
Well, if you were a scammer, would you think a simple email enough to convince someone that the company and job are legitimate and not a scam?
Is it possible there are legitimate companies offering this service? I guess it's possible, but one of the things they are offering is getting around the government (not only ours, but their clients') regulations and taxes. So "legitimate" is relative, here. They always deal with monetary amounts below the limit ("transactions of relatively small amounts of 1000-6000 USD.")
General Instructions
Who Must File. Each financial institution (other than a casino, which instead must file FinCEN Form 103, and the U.S. Postal Service for which there are separate rules) must file FinCEN Form 104 (CTR) for each deposit, withdrawal, exchange of currency, or other payment or transfer, by, through, or to the financial institution which involves a transaction in currency of more than $10,000.
Multiple transactions must be treated as a single transaction if the financial institution has knowledge that (1) they are by or on behalf of the same person, and (2) they result in either currency received (Cash In) or currency disbursed (Cash Out) by the financial institution totaling more than $10,000 during any one business day. For a bank, a business day is the day on which transactions are routinely posted to customers’ accounts, as normally communicated to depository customers. For all other financial institutions, a business day is a calendar day.
[Source: http://www.irs.gov/pub/irs-pdf/ffc104.pdf, p3. My highlights -wds]
What that means is they circumvent the US Government reporting requirements by keeping checks below the limit that REQUIRES reporting. They are offering you, as a "contractor" a chance to get your money, and report to the IRS whatever you wish. I also doubt you will get a 1099, because you will be scammed out of your money long before tax-time.
Let's put it this way... When you receive cash from anyone as a gift, as a payment for doing something or selling something, do you report it ALL? I doubt it. Few do. That's also why some people request cash payments. It's harder for the IRS to find out about. That's how they got Capone, you know? TAXES. The thing to remember is that taxes are required to make the government services we, as Americans DEMAND, work!
Ok... Besides the spelling, capitalization, and spacing problems on a "legitimate" financial services website, what else leads me to believe this is a scam?
Anyway, it appears a couple of con artists in Cuba have decided they can make money on the misfortunes of others or on those that are truly looking for work from home.
What could/would happen? Well, you get the check and deposit it in your account. You withdraw all but the 5% handling fee, and go to Western Union, where you wire the money to whomever was to receive it. You call the scammers, tell them the receipt number, and whatever other pertinent information the request, and they immediately hit the Western Union on their end and get the money. In a few weeks, your bank finds the check is invalid, and demand YOU to pay the money into your account. If you don't/can't, they have you arrested for passing bad checks. And if the dollar amount is high enough (and it probably will be), it will be a felony (federal). Most likely, you will go to prison. Oh... And the bad guys' phone numbers? They don't work any more. And, they are no longer at the address you had for them. So you take the heat all on your own.
And all you were doing was what you were told was a legitimate job.
Again, BE VERY CAREFUL when applying to Work-At-Home jobs.
Send comments/questions about this page to Bill Sanders at:
Go to Scams - Work-at-Home Scam Home page
Send email to Bill Sanders
()
with questions or comments about this page or site.
This site, all text and graphics (unless otherwise noted) on it
were designed, developed and published by Bill Sanders of Orange Frog Productions.
It and it's CSS was validated and complies with both the:
CSS and
HTML 4.01
validators from W3C.
NOTE: All CSS validates except the "New Window Buttons"
which include some invalid code (ie: hacks),
added PicoSearch Tables,
and warnings for using transparent backgrounds when color foregrounds defined.
Copyright © 2003, 2004, 2005, 2006, 2007 by Bill Sanders / Full site last modified: October 21, 2006
Any reproduction, printing, or selling of this content is
prohibited without express written consent from William D.
Sanders.
